summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWaldemar Brodkorb <wbx@openadk.org>2015-12-13 23:38:30 +0100
committerWaldemar Brodkorb <wbx@openadk.org>2015-12-17 20:35:20 +0100
commit8a783f5440817b8db8d27b6a3fb14c301ffa9ad7 (patch)
tree90046ed013e60a241ece29ce85d94a1e1cb5de3c
parentf72e003a5f168a32a77ee9248b2169b1e11d5198 (diff)
svc.c: svc_getreqset() buffer overflow
http://bugs.busybox.net/show_bug.cgi?id=5588 Signed-off-by: Leonid Lisovskiy <lly.dev@gmail.com> Signed-off-by: Waldemar Brodkorb <wbx@uclibc-ng.org>
-rw-r--r--libc/inet/rpc/svc.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/libc/inet/rpc/svc.c b/libc/inet/rpc/svc.c
index 6d7253a43..c3d55185b 100644
--- a/libc/inet/rpc/svc.c
+++ b/libc/inet/rpc/svc.c
@@ -448,6 +448,8 @@ svc_getreqset (fd_set *readfds)
register int bit;
setsize = _rpc_dtablesize ();
+ if (setsize > FD_SETSIZE)
+ setsize = FD_SETSIZE;
maskp = (u_int32_t *) readfds->fds_bits;
for (sock = 0; sock < setsize; sock += 32)
for (mask = *maskp++; (bit = ffs (mask)); mask ^= (1 << (bit - 1)))